Finnish National Bureau of Investigation
Finnish national police criminal investigation bureau; arrested alleged Scattered Spider member Peter Stokes at Helsinki airport.
Last refreshed: 30 April 2026 · Appears in 1 active topic
How did Finnish police catch Scattered Spider's Bouquet before he reached Japan?
Timeline for Finnish National Bureau of Investigation
Arrested Peter Stokes at Helsinki airport on 10 April 2026
Cybersecurity: Threats and Defences: Scattered Spider's Bouquet arrested in Helsinki- How did Finland arrest the Scattered Spider hacker Bouquet?
- Finland's KRP arrested Peter Stokes (Bouquet), 19, at Helsinki-Vantaa Airport on 10 April 2026 as he tried to board a flight to Japan. US charges filed under seal in Chicago in December 2025 and unsealed on 28 April allege wire fraud, conspiracy, and computer intrusion across at least four Scattered Spider breaches.Source: KRP / DOJ unsealed charges
- What is Finland's KRP and what crimes does it investigate?
- KRP (Keskusrikospoliisi) is Finland's National Bureau of Investigation, responsible for serious and organised crime, financial crime, cybercrime, and international criminal cooperation. It is Finland's primary liaison agency for Europol and Interpol, and the body that executes international arrest warrants on Finnish soil.Source: KRP
- Is the Scattered Spider hacker going to be extradited to the US?
- The United States is seeking extradition of Peter Stokes from Finland. The extradition timeline was listed as a watch item; Finnish and US legal processes must align before Stokes can be transferred to face the Chicago charges.Source: DOJ / KRP
Background
The Finnish National Bureau of Investigation (KRP — Keskusrikospoliisi) is Finland's national criminal investigation body within the Finnish National Police. It handles serious and organised crime, financial crime, cybercrime, and international criminal cooperation — the Finnish equivalent of a dedicated national criminal intelligence directorate. KRP operates under the Ministry of the Interior and is the primary Finnish agency for Europol and Interpol liaison, making it the institutional channel through which international arrest warrants are executed on Finnish soil.
KRP's cybercrime unit is Finland's lead domestic response to ransomware, cybercrime networks, and related criminal infrastructure. In the E-Note seizure (March 2026), KRP cooperated with the FBI and Michigan State Police on infrastructure takedowns, demonstrating the agency's established operational relationship with US law enforcement.
KRP arrested Peter Stokes, 19, a dual US-Estonian national known online as Bouquet, at Helsinki-Vantaa Airport on 10 April 2026 as he attempted to board a flight to Japan. Stokes is alleged to be a member of Scattered Spider, the most prolific English-speaking cybercrime collective of the past three years, with charges filed under seal in Chicago in December 2025 and unsealed on 28 April 2026 listing wire fraud, conspiracy, and computer intrusion. Federal prosecutors allege he participated in at least four Scattered Spider breaches, including a March 2023 hack of a communications platform carried out when he was sixteen. The United States is seeking extradition. KRP's role represents the operational template that cybercrime enforcement has established in this cycle — Finnish law enforcement as the execution Arm of a US indictment, coordinated with Estonian liaison services.
